Pixels can send health data to ad platforms by accident. This guide covers the court ruling, the FTC GoodRx case and a checklist for telehealth marketers.
Telehealth marketing runs on tracking: pixels, tags, audiences and conversion events. The same tools can send information about a person's health to an ad platform. This guide explains the legal backdrop in plain language and gives you a checklist. It is general information, not legal advice. Ask counsel whether HIPAA applies to your business.
For the wider growth plan, see our telehealth and weight-loss clinic marketing guide.
HIPAA applies to covered entities, such as many healthcare providers and health plans, and to their business associates. Some telehealth companies and clinics are covered, while others are not. Whether a peptide or wellness brand is covered depends on facts like whether it provides healthcare and how it bills. Do not assume either way.
In its bulletin on online tracking technologies, HHS's Office for Civil Rights took a position on when tracking on unauthenticated public pages triggers HIPAA. On 20 June 2024, a federal court in the Northern District of Texas (American Hospital Association v. Becerra) declared unlawful and vacated the part of that bulletin dealing with the “Proscribed Combination”, the idea that connecting an IP address to a visit to an unauthenticated page about specific conditions or providers triggers HIPAA obligations. On 29 August 2024, HHS-OCR withdrew its appeal.
That ruling addressed only that portion. It does not remove your duties elsewhere: tracking on logged-in portals, forms and patient areas, state privacy laws, FTC rules and platform policies all still matter.
In February 2023 the FTC announced an action against GoodRx. It alleged that GoodRx shared the names of medications and conditions its users searched for with advertising companies including Meta, Google and Criteo, and uploaded customer emails, phone numbers and advertising IDs to Facebook to target health ads. The result was $1.5 million in civil penalties, a ban on sharing health information with third parties for advertising, and the first enforcement action under the Health Breach Notification Rule. The case shows the risk is not limited to HIPAA.
| Place | Example | Safer approach |
| URLs | /book/weight-loss-consult?condition=... | Use neutral URLs and keep condition names out of query strings. |
| Event names and parameters | Event labelled with a diagnosis or medication | Use generic events such as “lead” or “booking started”. |
| Form fields | Intake answers captured by automatic form tracking | Turn off automatic form field capture on intake and patient pages. |
| Patient portals | Pixels on logged-in pages | Do not run ad pixels in authenticated or patient areas. |
| Uploaded audiences | Customer lists of treated patients | Do not upload lists that reveal treatment. See our Customer Match guide. |
You can still measure. Track clean events like “booking started” and “booking completed” with no health detail, and use server-side methods with discipline. Our guide to the Meta Conversions API and our guide to GA4 enhanced conversions cover setup, and LegitScript's standards also expect good privacy practice (see what LegitScript reviews).
It depends on whether you are a covered entity or business associate, which turns on facts such as whether you provide healthcare and how you bill. Ask counsel rather than assuming.
On 20 June 2024 a federal court in Texas vacated the part of HHS-OCR's tracking technologies bulletin on the 'Proscribed Combination', which tied HIPAA obligations to IP addresses and visits to unauthenticated pages about conditions or providers. It did not address the rest of the bulletin.
The FTC alleged GoodRx shared medication and condition information with advertising companies including Meta, Google and Criteo, and uploaded customer contact details to Facebook for targeting. GoodRx paid $1.5 million in civil penalties in the first action under the Health Breach Notification Rule.
Often yes, but with limits: keep health data out of URLs, event names and forms, avoid pixels in patient areas, and review the setup with counsel.
No. It is general information. Have a qualified lawyer review your tracking and privacy setup.
We help peptide, supplement and clinic brands run compliant Google and Meta campaigns that scale without putting the account at risk.
Get a free 30-minute audit of your Google Ads or Meta Ads account. We’ll review compliance, structure, and growth opportunities — no strings attached.
Book a Free Audit